Executive brief
Undici, a popular HTTP client for Node.js, contains a flaw in its retry mechanism that can cause it to send incorrect data length information to other applications. When used in proxy or gateway services, this can lead to connection hangs, corrupted data, or security desynchronization between different parts of a network. This could allow a malicious server to interfere with how a company's internal systems process web traffic.
Technical details
A vulnerability exists in Undici's `interceptors.retry()` where it may deliver a response body whose actual length does not match the provided `Content-Length` header after a retry or resume of a partial response. This occurs when an upstream server provides a mismatched `Content-Length` in a partial (206) response and then closes the connection prematurely; Undici's retry logic may then fetch the remaining bytes but fail to update the original header. If the application forwards these headers downstream without recalculation, it can cause HTTP response smuggling or desynchronization in intermediaries. The issue is patched in versions 6.28.0, 7.29.0, and 8.9.0.
Affected products
- Node.js undici < 6.28.0, >= 7.0.0 < 7.29.0, >= 8.0.0 < 8.9.0
Timeline
- 2026-07-29: disclosed
- 2026-07-29: patched
- 2026-08-03: advisory